Rule Info
Name
SUSP_VBS_Hide_Zip_Archive_Extraction_Sep26
Author
AzizFarghly
Description
Detects suspicious VBS scripts that hide ZIP archive extraction, commonly used by malware to conceal payload delivery
Score
65
Reference
Internal Research
Date
2026-09-02
Minimum Yara
3.5.0
Rule Hash
fe2d49969859b2cf6ca89aace6f22676
Tags
['SCRIPT', 'SUSP']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
3
Suspicious (< 10 engines)
8
Clean (0 engines)
1
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR